My Website was hacked using Statcounter! Does Statcounter keep a record of cookies?

Posted by Cyril Gupta on Stack Overflow See other posts from Stack Overflow or by Cyril Gupta
Published on 2010-03-20T10:06:04Z Indexed on 2010/03/20 10:11 UTC
Read the original article Hit count: 392

Filed under:

hacking

|

asp.net-mvc

|

cookies

|

.NET

|

authentication

I had a rather interesting case of hacking on my ASP.Net MVC website. For this website I had implemented a rather uncomplicated authentication system for my admin area -- an encrypted cookie which had an identifying signature for the member. Whenever the admin visits the website the cookie would be decrypted and signature verified. If matching he wouldn't have to sign in.

Couple of days ago a visitor on my site told me that he was able to sign into my website simply by clicking no a referral link on his Statcounter console which pointed to my admin area (I had visited his site from a link inside my admin view).

He just clicked on a link in statcounter and he was signed in as the admin!

The only way this could have happened was if statcounter somehow recorded my cookies and used those when he clicked on the link pointing to my admin!

Is that logical or fathomable?

I don't understand what's going on. Do you have any suggestions as to how I can protect my website against things like this?

© Stack Overflow or respective owner

Related posts about hacking

should i bother to block these- rather lame attempt at hacking my server

as seen on Server Fault - Search for 'Server Fault'
I'm running a LAMP stack, with no phpmyadmin (yes) installed. While poking through my apache server longs i noticed things like. 74.208.75.29 - - [16/Mar/2010:02:53:45 +0800] "POST http://74.208.75.29:6667/ HTTP/1.0" 404 481 "-" "-" 74.208.75.29 - - [16/Mar/2010:02:53:45 +0800] "CONNECT 74.208.75… >>> More
The newbie's guide to hacking the Linux kernel

as seen on Internet.com - Search for 'Internet.com'
<b>TuxRadar: </b>"We asked prolific kernel hacker (and Linux Format reader!) Greg Kroah-Hartman to tell us what it takes for newbies to patch the Linux kernel - here's what he had to say." >>> More
China Says Google Never Filed Complaint in Hacking Case

as seen on Internet.com - Search for 'Internet.com'
Confusion continues to muddle the Google/China saga, with Chinese officials saying they aren't -- and are -- in talks with Google about hacking and censorship allegations. >>> More
China Says Google Never Filed Complaint in Hacking Case

as seen on Internet.com - Search for 'Internet.com'
Confusion continues to muddle the Google/China saga, with Chinese officials saying they aren't -- and are -- in talks with Google about hacking and censorship allegations. >>> More
community of linux hackers

as seen on Super User - Search for 'Super User'
Do you know of any community of linux hackers. People who are into hacking from network to workstations. Linux hacking windows pc's and other platforms. Please do only tell sites wherein beginners could join. But if you know of any site that gives a jump start for beginners into hacking. Also tell. >>> More

Related posts about asp.net-mvc

Migrating ASP.NET MVC 1.0 applications to ASP.NET MVC 2 RTM

as seen on ASP.net Weblogs - Search for 'ASP.net Weblogs'
Note: ASP.NET MVC 2 RTM isn’t yet released! But this tool will help you get your ASP.NET MVC 1.0 applications ready for when it is! I have updated the MVC App Converter to convert projects from ASP.NET MVC 1.0 to ASP.NET MVC 2 RTM. This should be last the last major change to the MVC App Converter… >>> More
ASP.NET MVC 3 Hosting :: New Features in ASP.NET MVC 3

as seen on Geeks with Blogs - Search for 'Geeks with Blogs'
Razor View Engine The Razor view engine is a new view engine option for ASP.NET MVC that supports the Razor templating syntax. The Razor syntax is a streamlined approach to HTML templating designed with the goal of being a code driven minimalist templating approach that builds on existing C#, VB… >>> More
PathTooLongException after migrating from ASP.NET MVC 1 to ASP.NET MVC 2

as seen on Stack Overflow - Search for 'Stack Overflow'
I had updated my app from MVC 1 to MVC 2. After that some pages throws PathTooLongException: [PathTooLongException: The specified path, file name, or both are too long. The fully qualified file name must be less than 260 characters, and the directory name must be less than 248 characters.] … >>> More
Differece between Asp.net MVC 1 and Asp.net MVC 2

as seen on Stack Overflow - Search for 'Stack Overflow'
what is differece between Asp.net MVC 1 and Asp.net MVC 2? >>> More
Top 5 reasons for using ASP.NET MVC 2 rather than ASP.NET MVC 1

as seen on Stack Overflow - Search for 'Stack Overflow'
I've been using ASP.NET MVC 1 for a while now, and am keen to take advantage of the improvements in MVC 2. Things like validation seem greatly improved, and strongly-typed HTML helper methods look great. So, for those of you who have real-world practical experience of using ASP.NET MVC 1 and are… >>> More